Diagnose firebird database traffic

[Sego]

Hi all,

Recently we have implemented Forti equipement in our network.

1x FG100f connected to 2 48port FortiSwitches in MCLAG.

Since implementation , 3 months ago, everything works fine except one app that works with firebird database.

Client desktops and servers are separated with VLANs , on that particular policy non security profile is enabled.

Funny thing is that database server is hosting MS SQL and Firebird database engine, and only app using Firebird is causing issue which is that after xy minutes of idle time client app crashes with error:

INET/inet_error: read errno = 10054

Googleing this error is giving me direction to session timeout, poor network connections etc.

In our case there is no poor connection and regarding session timeout no defaults were changed, TTL is 3600s.

My question is how can i catch cause?

I was trying with debug flow , source ip dest ip and dstport but results i get are informative, just telling me 

InterVLAN Policy:

edit 6
set status enable
set name "interVLAN Users - DMZ"
set uuid eggggggg-f82f-51ef-1afd-xxxxxxxxxxxx
set srcintf "Users"
set dstintf "DMZServersInt" "DMZServersWAN"
set action accept
set nat64 disable
set nat46 disable
set ztna-status disable
set srcaddr "all"
set dstaddr "all"
set internet-service disable
set internet-service-src disable
unset reputation-minimum
set internet-service6 disable
set internet-service6-src disable
unset reputation-minimum6
set rtp-nat disable
set schedule "always"
set schedule-timeout disable
set policy-expiry disable
set service "ALL"
set tos-mask 0x00
set anti-replay enable
set dynamic-shaping disable
set passive-wan-health-measurement disable
set utm-status disable
set inspection-mode flow
set profile-protocol-options "default"
set ssl-ssh-profile "no-inspection"
set logtraffic all
set logtraffic-start disable
set capture-packet disable
set auto-asic-offload enable
set np-acceleration enable
set nat disable
set session-ttl 3600
set vlan-cos-fwd 255
set vlan-cos-rev 255
set fec disable
set wccp disable
set disclaimer disable
set email-collect disable
set natip 0.0.0.0 0.0.0.0
set diffserv-copy disable
set diffserv-forward disable
set diffserv-reverse disable
set tcp-mss-sender 0
set tcp-mss-receiver 0
set comments ''
set block-notification disable
set replacemsg-override-group ''
set srcaddr-negate disable
set srcaddr6-negate disable
set dstaddr-negate disable
set dstaddr6-negate disable
set service-negate disable
set timeout-send-rst disable
set captive-portal-exempt disable
set dsri disable
set radius-mac-auth-bypass disable
set delay-tcp-npu-session disable
unset vlan-filter
set traffic-shaper ''
set traffic-shaper-reverse ''
set per-ip-shaper ''
next

Debug:

Trace ID,Time,Message
Packet Trace #60,2025/05/13 09:00:18,"vd-root:0 received a packet(proto=6, 192.168.88.131:55329->192.168.80.13:3050) tun_id=0.0.0.0 from VLAN88. flag [S], seq 1911094186, ack 0, win 65535"
Packet Trace #60,2025/05/13 09:00:18,allocate a new session-0e97c6c5
Packet Trace #60,2025/05/13 09:00:18,"in-[VLAN88], out-[]"
Packet Trace #60,2025/05/13 09:00:18,len=0
Packet Trace #60,2025/05/13 09:00:18,"result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"
Packet Trace #60,2025/05/13 09:00:18,find a route: flag=04000000 gw-192.168.80.13 via VLAN80
Packet Trace #60,2025/05/13 09:00:18,"in-[VLAN88], out-[VLAN80], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0"
Packet Trace #60,2025/05/13 09:00:18,"gnum-100004, use addr/intf hash, len=27"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-14, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-1, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-2, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-38, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-38, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-40, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-40, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-9, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-9, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-48, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-13, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-10, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-10, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-11, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-26, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-25, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-12, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-36, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-23, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-100004 policy-6, ret-matched, act-accept"
Packet Trace #60,2025/05/13 09:00:18,ret-matched
Packet Trace #60,2025/05/13 09:00:18,"gnum-4e20, check-ffffffbffc02bd54"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-4e20 policy-6, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-4e20 policy-6, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"checked gnum-4e20 policy-6, ret-no-match, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"gnum-4e20 check result: ret-no-match, act-accept, flag-00000000, flag2-00000000"
Packet Trace #60,2025/05/13 09:00:18,"policy-6 is matched, act-accept"
Packet Trace #60,2025/05/13 09:00:18,"after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-6"
Packet Trace #60,2025/05/13 09:00:18,"after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-6"
Packet Trace #60,2025/05/13 09:00:18,Allowed by Policy-6:
Packet Trace #61,2025/05/13 09:00:18,"vd-root:0 received a packet(proto=6, 192.168.88.131:55329->192.168.80.13:3050) tun_id=0.0.0.0 from VLAN88. flag [.], seq 1911094187, ack 3650422949, win 255"
Packet Trace #61,2025/05/13 09:00:18,"Find an existing session, id-0e97c6c5, original direction"
Packet Trace #61,2025/05/13 09:00:18,"Trying to offloading session from VLAN88 to VLAN80, skb.npu_flag=00000400 ses.state=00010204 ses.npu_state=0x00000800"
Packet Trace #61,2025/05/13 09:00:18,npu session installation succeeded
Packet Trace #61,2025/05/13 09:00:18,"state=00010204, state2=00000001, npu_state=00000c00"

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Sego]

Thank you Anthony!

[Anthony_E]

Anytime!

I'm continuing to look for an expert.

Regards,

[Anthony_E]

Hi Sego,

I did some research and here are the results:

To diagnose Firebird database traffic on a FortiGate, you can use the packet sniffer command to capture and analyze the traffic. Here’s how you can do it:

1. Access the FortiGate CLI: Connect to your FortiGate device using SSH or through the console.
2. Use the Sniffer Command:Use the `diagnose sniffer packet` command to capture traffic. You can filter the traffic to only capture Firebird database traffic by specifying the appropriate port (default is TCP port 3050).

Example command:

diagnose sniffer packet any 'tcp port 3050' 4 <----- The `4` at the end of the command specifies the verbosity level of the output.

3. Analyze the Captured Traffic: Review the output to analyze the Firebird database traffic. Look for any anomalies or issues in the traffic flow.
4. Stop the Sniffer: Press `Ctrl+C` to stop the packet capture when you have gathered enough data.

This method allows you to monitor and diagnose Firebird database traffic on your FortiGate.

Do not hesitate to tell me if it helps. If not we will continue to look for an answer.

Regards,